2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer
Size 2.7MB
Sample260522-cvscpsfv41
SHA256 c0c2382f9f703f2aea6e64194331ebc2fd248d6b76ae7917babdf6b12f2b7df8
MD5 1549c9134cf149d95358b950b80a7828
SHA1 4a15ca8e6deff9adcf026cc80293bb47a37b0324
SHA512 d8d16f81e8c0bdf8569b7640ec8879c9745cc0a4e45e833a8a90dd733baa324e636e5e295223523cc6629babcb6744757fe57b204ffd409f3d6f2e5aa0fc4a6e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3X:CebAjOKn3wRKRJ3X
TLSH
T189D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer

File Explorer

2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer

.exe 2.7MB

2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer

IMPHASH 14b4507f976e32ec2f82aea1cd56dda1
SHA256 c0c2382f9f703f2aea6e64194331ebc2fd248d6b76ae7917babdf6b12f2b7df8
MD5 1549c9134cf149d95358b950b80a7828
SHA1 4a15ca8e6deff9adcf026cc80293bb47a37b0324
SHA512 d8d16f81e8c0bdf8569b7640ec8879c9745cc0a4e45e833a8a90dd733baa324e636e5e295223523cc6629babcb6744757fe57b204ffd409f3d6f2e5aa0fc4a6e
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3X:CebAjOKn3wRKRJ3X
TLSH
T189D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2130360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

client.pdb

kernel32

GetVolumeInformationW GetDiskFreeSpaceExW DeviceIoControl OpenProcess GetExitCodeProcess WaitForMultipleObjects GetProcessTimes GetSystemTimes GetProcessIoCounters GetFileAttributesW CreateProcessW GetWindowsDirectoryW VirtualQueryEx GetTickCount64 GetLogicalDrives GlobalMemoryStatusEx GetSystemDirectoryW ReadFile GetOverlappedResult CancelIo PostQueuedCompletionStatus CreateEventW ExitProcess CreateWaitableTimerExW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI GetSystemInfo GetSystemTimePreciseAsFileTime ReadFileEx SleepEx WriteFileEx CreateThread DeleteFileW GetTempPathW GetModuleFileNameW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime CreateFileW FindFirstFileExW GetFullPathNameW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetModuleHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SwitchToThread GlobalUnlock GlobalLock HeapReAlloc GetCurrentThread SetThreadStackGuarantee LoadLibraryA WaitForSingleObject SetFileInformationByHandle MoveFileExW GlobalSize GlobalAlloc GetComputerNameExW WaitForMultipleObjectsEx SetThreadPriority GetCurrentThreadId SetEvent CreateEventA CopyFileExW FindClose FindNextFileW GetModuleHandleA Sleep FormatMessageW HeapAlloc HeapFree GetProcessHeap LoadLibraryExA GetProcAddress FreeLibrary DuplicateHandle SetHandleInformation TerminateProcess IsProcessorFeaturePresent SetLastError LocalFree GetDriveTypeW GlobalFree CloseHandle SetWaitableTimer GetLastError SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter IsDebuggerPresent lstrlenW MultiByteToWideChar WideCharToMultiByte AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal ReadProcessMemory FormatMessageA SystemTimeToFileTime OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection

combase

CoTaskMemFree

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile RtlGetVersion NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

ole32

CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity

mfplat

MFCreateSample MFStartup MFShutdown MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

oleaut32

SysAllocString GetErrorInfo SysFreeString VariantClear SysStringLen

ws2_32

socket getaddrinfo freeaddrinfo recv send ioctlsocket closesocket connect bind setsockopt getpeername WSAGetLastError getsockname WSACleanup getsockopt WSAIoctl WSASocketW WSASend shutdown WSAStartup

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

secur32

LsaGetLogonSessionData DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA LsaFreeReturnBuffer LsaEnumerateLogonSessions EncryptMessage FreeContextBuffer AcceptSecurityContext FreeCredentialsHandle DecryptMessage ApplyControlToken InitializeSecurityContextW

crypt32

CertDuplicateCertificateContext CertDuplicateStore CertDuplicateCertificateChain CertFreeCertificateContext CertEnumCertificatesInStore CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertCloseStore CertOpenStore

advapi32

RevertToSelf GetLengthSid IsValidSid ImpersonateAnonymousToken SystemFunction036 GetTokenInformation OpenProcessToken GetUserNameW LookupAccountSidW CopySid RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

user32

ShowWindow FindWindowA EmptyClipboard EnumDisplaySettingsExW GetMonitorInfoW EnumDisplayMonitors CloseClipboard OpenClipboard SetClipboardData MessageBoxA GetClipboardData BlockInput

shlwapi

AssocQueryStringW

gdi32

GetObjectW GetDIBits StretchBlt SetStretchBltMode SelectObject CreateCompatibleBitmap CreateDCW GetDeviceCaps DeleteDC CreateCompatibleDC DeleteObject

iphlpapi

GetIfTable2 GetIfEntry2 FreeMibTable GetAdaptersAddresses GetIpForwardTable

powrprof

SetSuspendState CallNtPowerInformation

shell32

SHGetKnownFolderPath CommandLineToArgvW

psapi

GetModuleFileNameExW GetPerformanceInfo

pdh

PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter PdhCloseQuery

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserGetInfo NetUserEnum

vcruntime140

__current_exception memcpy __CxxFrameHandler3 strrchr __C_specific_handler memmove memcmp strchr memchr memset __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr log _dclass fabs pow roundf

api-ms-win-crt-string-l1-1-0

strncmp strcspn strspn strlen wcslen strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment terminate _initterm_e _configure_narrow_argv exit _exit __p___argc _crt_atexit _set_app_type _seh_filter_exe _endthreadex _register_onexit_function _initialize_onexit_table _beginthreadex __p___argv strerror _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-heap-l1-1-0

free realloc malloc _msize _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-22_1549c9134cf149d95358b950b80a7828_akira_glassworm_rusty-stealer

kernel32

combase

ntdll

ole32

mfplat

mfreadwrite

mf

oleaut32

ws2_32

api-ms-win-core-synch-l1-2-0

secur32

crypt32

advapi32

bcrypt

bcryptprimitives

user32

shlwapi

gdi32

iphlpapi

powrprof

shell32

psapi

pdh

netapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic